Russia reportedly detains DataSuckers extortion suspects

Russian authorities have reportedly detained three of four suspected members of the financially motivated extortion group DataSuckers, the crew that hit Ukraine's largest grocery chain ATB earlier this month. The arrests are sourced to Russian and Kazakh reporting, not an official filing, and Recorded Future News says it could not independently verify how law enforcement located the suspects. There is no vendor advisory here — treat the specifics as reporting, not confirmed fact.

What's reported

Per the Telegram channel Baza and the Russian daily Kommersant, as relayed by Recorded Future News, police traced one suspect — named as 19-year-old Denis Fridman — to his home in Barnaul, Russia. A Moscow court reportedly placed Fridman under house arrest until December 8 on a charge of "illegal handling of computer information containing personal data." The other two detained suspects are described as citizens of Russia, Kazakhstan or Belarus; a fourth is said to remain at large. Kazakh outlet bes.media corroborates the detentions and the Kazakh-national detail.

Baza attributes the break to operational sloppiness: one group member allegedly logged into the stolen dataset in a way that exposed them. That detail rests on a single Telegram source — weigh it accordingly.

Who DataSuckers hit

DataSuckers runs a Russian-language Telegram channel and publishes write-ups of the intrusions it claims. Its target list cuts across the Russia–Ukraine line:

• Dodo Pizza (Russia): the company confirmed an attack that continued on September 27–28. The group claimed 2–3 TB of data; some Russian-language reports cite specialists estimating up to 3.7 TB. Entry point, per reporting, was Dodo Pizza credentials left exposed on GitHub.
• Tez Tour (Russia): a tour operator hit in September that disputed any customer-data compromise.
• ATB (Ukraine): a $400,000 demand and a claim of 7.9 million customer records, posted via a countdown timer on ATB's own site on October 5. ATB denied customer data was taken.

In every case the claimed volumes are the attackers' figures and remain unverified.

What to do

Nothing operational changes for defenders on news of an arrest — there is no CVE, no patch, no IOC in this story. If you were in scope of DataSuckers' earlier claims, the guidance from our ATB coverage still stands: rotate any credentials in a claimed dataset, watch for phishing that reuses leaked contact and order data, and review integrations with named victims. The one durable lesson in the Dodo Pizza account is older than any of this: credentials committed to a public GitHub repo are an open door — scan your own history for them.

Context

Arrests of named extortion crews are rare, and attribution to specific individuals rarer still — most of what we know about DataSuckers is self-published or relayed through Russian media, both of which have their own incentives. Hold the names and charges loosely until a court record or an official statement surfaces. What the case reinforces is the shape of the group we described earlier: a crew that skips file encryption entirely, steals and extorts, and follows data and payout rather than flags — breaching Russian firms and a Ukrainian one with equal indifference. If the detentions hold up, they also puncture the operators' tradecraft: a login slip, not a vendor patch, is what reportedly ended the run.